scout-attribute

Attribute Kubernetes field values to their writers using metadata.managedFields and controller tracing.

14|Updated Jan 17, 2026
One-click install
npx skills add https://github.com/confighub/cub-scout --skill scout-attribute
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: scout-attribute
Source: https://github.com/confighub/cub-scout/tree/main/skills/scout-attribute
Command: npx skills add https://github.com/confighub/cub-scout --skill scout-attribute

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It solves the problem of figuring out where a specific Kubernetes field value came from (the controller that wrote it, the git source behind it, or a ConfigHub Link binding) so you can answer “why is this value like that?” during drift, audit, or investigation.

Core Features & Use Cases

  • Per-field mutation attribution: Enriches three-way compare and explain output with cause, managerHint, and evidence derived from Kubernetes metadata.managedFields.
  • Git-source provenance: Reports the controller-derived {repoUrl, revision, path} and, when a local checkout is available, adds raw YAML file:line back-resolution.
  • ConfigHub binding lineage (connected mode): Identifies which ConfigHub Link(s) and upstream unit/path(s) feed a given field via bindingSource and incomingBindings[], supporting “upstream intent vs live field” investigations.
  • Use case: When a deployment’s replicas differs between live and governed intent, you can identify whether it’s likely controller-driven drift vs a manual override and trace the value to its upstream unit/path.

Quick Start

Ask your AI to run a three-way compare for a field mismatch and include attribution details: “Show me the provenance of replicas on Deployment/api in namespace prod, and explain whether it’s controller-drift or manual-edit.”

Frequently Asked Questions about scout-attribute

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find out which controller wrote a specific Kubernetes field value?

You can attribute live Kubernetes field values to their most likely writer by combining metadata.managedFields, controller tracing, and optional ConfigHub Link lineage to pinpoint the exact source of truth during investigations.

What is the best way to trace Kubernetes drift back to a git source?

Tracing Kubernetes drift to a git source involves reporting the controller-derived repo URL, revision, and path, and when a local checkout is available, resolving the raw YAML file and line number to pinpoint the exact provenance.

Can I identify if a Kubernetes deployment field mismatch is manual override or controller drift?

You can determine whether a deployment field mismatch is controller-driven drift or a manual override by enriching three-way compare output with cause and managerHint evidence derived from metadata.managedFields.

Does Kubernetes field attribution work without write access to the cluster?

Kubernetes field attribution works with read-only access to cluster metadata, combining managedFields, controller tracing, and ConfigHub Link lineage to perform provenance investigations safely.

How does ConfigHub binding lineage help investigate upstream intent versus live Kubernetes fields?

ConfigHub binding lineage identifies which Links and upstream unit paths feed a given field via bindingSource and incomingBindings, supporting connected mode investigations comparing upstream intent against live Kubernetes field values.

What happens when the source of a Kubernetes field value cannot be determined?

When the source of a Kubernetes field value cannot be determined, the attribution process expresses missing evidence honestly as cause: unknown, ensuring the provenance investigation never guesses the writer or source.